CVE-2023-51386

    Dashboard / Vulnerabilities / CVE-2023-51386

    CVE-2023-51386

    Published: 22 Dec 2023Last Modified: 12 Aug 2026

    Summary: Sandbox Accounts for Events vulnerable to privilege escalation to read running events data

    Details: Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51386.json, https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-p7w3-j66h-m7mx, https://nvd.nist.gov/vuln/detail/CVE-2023-51386, https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -f30a0662f0a28734eb33c5868cccc1c319eb6e79

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-51386 | CVE-DB